I think this illustrates that you can just do stuff without claiming it is useful. Like couldn't you just make this font and call it something like double-entendre or something?
I once held the belief that any marketing material showed the exact opposite of reality, and this page does exactly that: It doesn't stop AI from reading it, but it sure stops me!
Gemini flash responds to "can you read both messages here?" with:
Yes, this is a clever optical illusion! Depending on which layers your eyes focus on, you can read two entirely different messages in this image:
Message 1 (The sharp outline layer):
PAY BILLS
How to see it: Focus on the sharp, concentric black outline contours of the letters.
Message 2 (The soft, blurry shadow layer):
DAY DREAMS
How to see it: Let your eyes relax/defocus slightly, or step back from the screen to focus on the soft, heavy grey drop shadows. The blurred shadows transform the "P" into a D, the "B" into a D, the "I" into an R, the "L"s into an M, and the "S" is shared!
It only works if you give it a screenshot, but it wouldn't work to block AI scrapers or fetch tools, and I think if printed out, it wouldn't work reliably if you took a photo, especially from afar
It would be trivial to train future models to detect and read it though (and some already can, based on other comments in this thread). It only works as much as it does because it's new and reading it hasn't been a goal.
The demonstration might, and it may work for certain models with certain prompts, but I just asked gemini if it could see both and it both did see both and gave me a tutorial on how I could see both as if it were a simple magic eye poster.
I mean, I've worked for companies where their curated sales demonstrations showed the speed of light is easily breakable... Do your own testing with some thinking applied.
I mean, I can defeat AI by putting white text on a white background and turning to a picture. Also means it's worthless for actual humans to read too. Try to actually use it on a site and chances are you'll get an ADA complaint.
Ehh. Probably not many people will be using this particular thing to thwart ai BUT I think it may be a stop on a path towards something very useful someday.
The obvious outlined text says “SORRY ROBOT,” but the hidden message is “HAPPY HUMAN.”
It’s Mixfont’s Decoy Font: the outlined letters attract machine vision, while the softer tonal pattern becomes readable to humans when viewed from farther away or at a smaller size. It’s an optical trick, not encryption.
Yeah, it doesn't seem that hard to beat, especially with a little trad image processing, yet I have a hard time reading it as well. One could probably fine-tune a much smaller model to do pretty well on this problem too.
It's interesting how zoom levels affect legibility. The first example is so large on my main monitor that I can only read the decoy text. Zooming out reveals the actual text. Which implies that all one would have to do is teach the LLM to downsample it once or twice, and it would then be able to read it...
It took me defocusing my eyes to read the hidden text with normal ease. When I tried it, squinting only made it focus in on the thin lines instead of the background.
wow that's kind of crazy impressive that it can do that honestly, VLMs have gone so far, can't imagine the crazy amount of annotations they had to create to get to that level
Downsizing is effectively low pass filtering, so that's expected. Any scheme that transmits different messages in different frequency bands is going to be susceptible to a similar attack.
Nice! A few years ago during my PhD I had made a Mathematica notebook that would take two images, crop them to the same size, apply a high-pass filter to one (which keeps the small sharp details) and a low-pass filter to the other (which keeps the large blurry blobs) and then superpose them back together. It was a bit hit and miss because e.g. if the eyes of two people were not in the same location the illusion would kind of break, but for text with outlined fonts it was amazing. I made a large one that would read "SCIENCE" from afar and "WORKS" from up close and stuck it on my office door.
Hmmmm... I wonder if there is a caesar cipher font or other substitution cipher fonts out there to actually obfuscate the data. So you use this to display to a user text but the unicode is re-mapped so that a is pointing to unicode g for instance. You remap the text to display correctly but contain massively swapped around unicode. Of course cut and paste would be a killer here but it is a price to pay for poisoning training data I guess.
I thought that's what it was going to be when I read the submission title. But like the other methods of obfuscation, it only works until the model learns about it.
It's been really interesting seeing how LLMs perceive things differently than humans. I'm working on image->html conversion pipelines right now, and there are glaring issues LLMs run into that are obvious for humans. Any subtle gradients get lost, 75 degree angles get converted to 90 degree angles, etc.
This tracks towards what you're seeing with this font - the high frequency details get picked up, but the low frequency ones dont.
I was so confused about how this was human readable until I realized that if the background is dark (I have an extension that forces dark theme) you see the decoy text, but if the background is white you see the real text.
The assumption is that if you use this alone to try to convey information to a human, a human with a visual disability can't use it. If you also provide a text channel (e.g. `ALT="…"`) then the LLM can use that and doesn't need to read the confusing image.
It only works as a decoy when you give it to the LLM as an image. As html it appears like normal human friendly text, which is what screen readers use to interpret the text.
> Maybe the more interesting thing is how far people are going to 'fight' against AI?
All ”AI resistance” I’ve seen is not against the tech, but against human bad actors behind AI: unethical procurement of training data, reckless application, low effort high volyme spam, replacing humans, centralization of power, dependency on megacorps etc. I think a lot of people have become less tech-positive after the ad-tech era that brought us social media, unprecedented levels of surveillance, freemium rug pulls etc. It’s much easier to understand the resistance if you place it in that context, rather than imagining millions of sleeper agent luddites suddenly coming out of the woodworks.
Admittedly I'm a bit salty about LLMs due to they constant attacks on our infrastructure, the damage their doing to peoples minds and the general lack of morals shown by the AI companies, but things like this is rather childish and not really a solution to anything.
I think this would be more interesting if the underlying letters were the fake letters as well. For usability it wouldn't be as good as you'd need an encoder, but it'd be cool because an AI with browser access couldn't read the contents either.
Even in the article ChatGPT correctly speculates that the blurry background may reveal another message if you squint or view it at a distance (which, given how common similar illusions are, is not particularly impressive but still).
Everyone trying so hard to do something "useful" that they don't recognize when all they've done is make art.
Had this been described as a font that contains two overlapping messages for fun effect, everyone would understand and love it.
Instead, we get this zero-introspection take: "Decoy font is...more difficult for AI to read. If you’re having a hard time seeing the hidden message..."
It's difficult to read period and has zero effect on current SOTA or future AI. But it does show two overlapping messages that can be read in different ways.
Can someone explain the actual use-case here? I'm struggling with this because it also hides the message from myself, making it incredibly hard to type because I have no confirmation that I hit the right keys on the keyboard.
Very neat! I like how the decoy text is less visible to the human eye than the "hidden" message, but it's the other way for the image models. Well done!
I am still figuring out what use case this might have. Why would you want to deceive an AI? Not to mention that, eventually, all AI systems will end up reading it.
This one seems much more likely to work for its intended purpose. Even if an LLM can be trained to read it, it will probably take much more processing to get the text out of a video compared to an image.
I'm surprised the AI reads the outline version, since I thought most scaled the image down, which is basically a low-pass filter on those single-pixel lines.
I don't think the font can actually do that - I think it is a hand-crafted example of the idea. The later examples all have random letters for the decoy text.
What would be cool would be neon signs using this font, where the front tubes show the decoy message, but then there’s hidden rear tubes that shine light on the wall in a different color showing the actual message.
Something like the DAY DREAM/PAY BILLS would be pretty artistic!
>Most AI systems work by reading the pixels of an image up close.
Not really, most AI systems work by reading the octets as ASCII/unicode (and then tokenizing it).
You could make an even better decoy font that renders one letter as another, so when you copy and paste it onto some other place with a normal font it reads as garbage, and garbage is what the AI will see, however if you render it with the descrambling font, you will see the regular message.
This has been used in PDF files as an obfuscation and anti-copy mechanism.
I can easily read both but here's the funny thing: with my reading glasses on, I first see "Sorry robot". If I remove my glasses, I first see "Happy human".
Which makes me think this is one blurr filter away from being trivially read by any model.
1) Make an ambiguous text
2) Feed it to AI and see which of the 2 it picks
3) If it detects both repeat step 2 using minor adjustments or different AI model until AI responds with one of 2 message
4) Make a blog post claiming that AI chose dummy and other message was the real one
reply